Main question: How to change the DNS to proton (10.2.0.1) without loosing the internet access?
I do use a Cudy WR3000s connected to a Vigor 130 via PPPoe.
When using VPN client functionality for one specific IP as configured in PBR what is working flawless, I still can see from that IP in VPN my local DNS with dnsleaktest.com so I guess I do have a DNS leak
Same for ipleak.net it shows me the local provider in WebRTC detection for IPv6. And Yes the IPv4 is pointing to the Proton location.
I thought changing DNS for WAN to Proton DNS may help -> Result Internet access gone, so I cannot use that.
Internet is gone for the whole network not only that one IP what is connected to the VPN client. Any idea what can cause this issue?
I know from your earlier threads that you have a VPN (WireGuard running) and that your default route is going via the WAN. This is important as DNSMasq which is providing the DNS is running on your router and will take the default route for all DNS requests.
When you use a DNS server for DNSMasq which is not publicly available (available trough the WAN), such as the one you use (10.2.0.1), then you will not have DNS resolution, you can add routing to route this DNS server via the tunnel but it is still a bad idea for two reasons:
DNS is then only available if the tunnel is up and for the tunnel going up you need DNS (for time and endpoint resolution) so you end up in a catch 22 situation (there are however ways to mitigate this)
But even if you can make this work you still have a DNS leak but then for all your client using the WAN because those are now using DNS via the VPN.
A DNS leak can be defined in multiple ways, the most annoying DNS leak is if the geographical origin of DNS and IP address are different which is caused by a different route of the DNS and IP traffic.
This geographical check is what is done by streaming services, banks, amazon etc. (among other things) to detect VPN use.
So the Solution is to Split DNS.
As default is via the WAN all LAN clients using the WAN are fine.
For the LAN clients using the VPN via PBR you also have to make sure those use the VPN for their DNS.
One way is to use DNS option 6 but it can also be done with PBR DNS Policies.
In your case where you have only a limited number of clients using the VPN use the PBR DNS policy for that client.
See: https://github.com/egc112/OpenWRT-egc-add-on/tree/main/stop-dns-leak#policy-based-routing
WebRTC leak is a browser problem which you need to address but that is outside the scope of OpenWRT
Unbelievable and all on that little machine running OWRT
I will check if I can get that running, PBR is already up and running and I saw that config for DNS already, was also reading about it in the manual, but that is all not so easy to understand ....
Almost, you have IPv6 active on the client and probably your client also has got an IPv6 DNS address from the router so to prevent an IPv6 DNS leak better make sure you also make a rule for IPv6 DNS.
That is the same rule but with an IPv6 address as you probably do not want IPv6 address you use an IPv6 address of :: which means all zero's
Usually you add an IPv4 and IPv6 DNS server on the WG client interface and then specify this WG client interface as Remote DNS the DNS PBR rule then set both a rule for IPv4 and IPv6
You mean like that? With that :: I am catching all IPv6 addresses which might occur for that specific MAC?
EDIT: Wait that would mean any IPv6 address doen´t matter what device is using the WGClient, right? What would be OK!
The other way you are describing is just another method, easier to control I assume but where do I add that IPv6 DNS server entry in LUCI?
How to distinguish IPv4 and v6?
This is the relevant tab in LUCI for the WGClient interface > Advanced settings?
No the local source is the MAC address the same as the already existing rule, the remote destination is the IPv6 DNS address but as we do not want IPv6 resolution as you do not have IPv6 we use a fake IPv6 address which is :: meaning all zero's
below the DNS address you already have.
I use Mullvad which supports IPv6 so I have in the Mullvad interface:
I already send you the link and the answers are already there please read it
OK adjusted the local source and remote destination will test that in a few minutes
BTW: I was reading your link but didn´t fully understand
For the DNS settings in WGClient interface, I did the one entry for proton IPv4 but I don´t have an IPv6 entry cause proton doesn´t offer that.
Should I add here the entry :: and unflag "use default gateway" and this way I don´t need to add DNS PBR rules the in PBR for each device, cause the whole WGClient interface will run via these DNS servers?
Now Testing on the fire stick.
Unfortunately ipleak.net still shows on the ipv6 the home DNS server.
I am using the Silk browser on the stick to test that
What I tried now following your guide, I maintained these DNS settings in the interface wgclient (also device is wgclient) and assigned in PBR policies only one entry per MAC address and assigned as remote DNS wgclient (this is the device)
Result: Not working ignores the VPN completely that way
I maintained as device just wgclient or should that be @wgclient?
(Yes restarted device and PBR and interface)
Therefore back to the settings as before means one PBR police for IPv4 and two DNS policies for IPv4 and v6.
That is 100% working on the Laptop but isn´t 100% working for the Firestick.
Means IP4 is covered IPv6 not reachable no additional DNS detected, just the WebRTC leak detection on the firestick and I think this is caused by the famous Amazing:-) technology.
I am using to test the SILK browser (no other available) on the stick and additionally I am logged on to my ama... account there.
Do you see any chance to get rid of that WebRTC leak?
Is the VPN protecting me with that WebRTC leak?
This is the config I am using now, below the two config files
For Remote DNS you use the dropdown box to choose the wgclient from the dropdown menu but the box should show wgclient indeed.
As the Local address contains the MAC address of the client and the MAC address is both IPv4 and IPv6 and the Remote DNS is the wgclient interface which also holds an IPv4 DNS server and an IPv6 DNS server you should have two rules automatically made in the firewall, one for IPv4 and IPv6
But If I understand you correctly the separate rules work and so I consider your problem as solved
Therefore I am not going to look further into it also because it works for me with one rule (I duplicated your setup with a proton client)
It might be because you are using an older PBR client but I guess we will never know.
About WebRTC leak that is a browser related problem.
Most browsers can disable WebRTC or you can use an Add-on for the browser to disable WebRTC.
I think you can disable it for FireFox and Brave browsers not sure about Chrome for Android but this is outside the scope of this thread and outside the OpenWRT scope.
